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Joe Moell RE. K0OV 
PO Box 2508 
Fullerton CA 92633 

Testing Motron's 
Transmitter Fingerprinter 

According to many hams, Southern 
California has a reputation for being 
the repeater-Jamming capital of the 
world. As someone who has traveled 
and talked to many repeater owners 
and users, I think that reputation is un- 
deserved. The sad truth is that you 
can find examples of illegal repeater 
use in big cities and small towns ev- 
erywhere. 

With hundreds of coordinated 2 
meter repeaters between Santa Bar- 
bara and the Mexican border, hams 
here can be proud that only a handful 
have ongoing problems with jamming, 
bootleggers, and unidentified trans- 
missions. The rest are full of friendly 
and helpful hams who seldom face 
these problems. 

Of course, there are occasions 
when nets and round tables on even 
our "cleanest" repeaters are brought 
to a halt by carriers, tones, and cuss 
words. When a phone call goes out 
to a radio direction finding (RDF) 
team, the job is not easy if there are 
many perpetrators in scattered loca- 
tions. It would be a huge help to be 
able to separate and identify which 
transmissions come from which 
source. 



Radio Direction Finding 



Just Like Snowflakes 

We all know that every human is 
unique and can be identified from all 
others by differences in the skin pat- 
terns on the fingertips and DNA in the 
cells. These methods require the per- 
son to submit to examination or test- 
ing. When this is not possible or de- 
sired, a voiceprint can be done from a 
distance, without the knowledge of the 
subject, at the cost of greater uncer- 
tainty. 

Similarly, every radio transmitter is 
unique. You cannot read the serial 
number on its nameplate from a dis- 
tance, but you can identify it by ana- 
lyzing, with sufficient precision, the 
characteristics of its signal. Differ- 
ences in signals, however slight, are 
always present due to differences in 
individual parts and the randomness 
in factory testing and tuning tech- 
niques. 

You may have heard reports of 
unique transmitter "signatures" and a 
technique called "fingerprinting" to 
identify rigs used for illegal activities 
and to apprehend their owners. What 
these reports usually leave out is the 
fact that this technique was invented 
by a ham and such equipment is now 
available for purchase. 

A Sleepless Experimenter 

When I spent nine months on 
assignment in Seattle back in 1972, 
the city's most popular repeater 
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Figure 1. Two consecutive transmissions from a crystal-controlled repeater trans- 
mitter. Subaudible tone modulation (CTCSS) is plainly visible. TxlD-1 computes 
and displays the CTCSS frequency below the trace. 
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88/86/94 18:17:86 18:17:18 



Figure 2. Two consecutive transmissions from the same FT-530 handie-talkie on 
the same frequency. Except for the ringing duration, the fingerprints are almost 
identical. 



was run by Phil Ferrell W7PUG, an 
engineer at The Boeing Company. 
Today, this repeater is as popular as 
ever, Phil is K7PF, and he has retired 
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Photo A. All you need to take transmitter fingerprints is a suitable receiver and a computer with the TxlD- 1 hardware and soft- 
ware installed. Not shown is an optional tape recorder for documenting audio and fingerprints simultaneously. 
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to work on his own pet projects. 

In the mid '80s, when unidentified 
signals appeared on the Seattle re- 
peater Phil decided to fight back by 
using his knowledge of signal analysis. 
He reasoned that most of the offend- 
ing transmitters were owned by li- 
censed hams and could be identified 
by comparing their signals to those of 
regular and occasional repeater users. 

The first design challenge was to 
figure out what signal characteristics 
to look at. "I had heard FM transmit- 
ters come on the air on top of one an- 
other," says Phil. "There would be a 
heterodyne with a chirp or quickly war- 
bling tone at the beginning, as the 
phase-locked loop (PLL) settled on 
frequency. I researched PLL theory, 
which goes into a branch of math in- 
volving Gilbert transforms. That wasn't 
helpful, so I tried looking at it as a low- 
bandwidth FM phenomenon." 

After some experimentation, his 
transmitter fingerprinting scheme took 
shape. It takes 2,048 instantaneous 
frequency samples at 100 microsec- 
ond intervals at the beginning of a 
transmission, then averages and filters 
this data to display and record 64 su- 
per-samples of frequency versus time. 

"Amplitude and multipath don't 
have much effect," says K7PF. "It's a 
robust technique and works under 
almost all conditions. Even on signals 
of -120 or -125 dBm, when the audio 
is almost unintelligible, the low band- 
width of the system gives a pretty 
decent fingerprint." 




Figure 3. These two HTX-202 transceivers were bought at the same time, but Figure 4. In a rapid-exchange OSO, this TH-78A produces consistent fingerprints 
have distinctly different fingerprints. They were set for the same power level on like the one at left. If the rig sits for a few moments until the battery-saver feature 
the same frequency. activates, the next transmission looks like the trace at right. 



There were distinctive characteris- 
tics on every radio he tested, even 
those of the same rnodei. "I was show- 
ing the system at a club meeting and a 
husband and wife stood up," he goes 
on. "They both had brand-new Aiinco 
handhelds with adjacent serial num- 
bers. He told me flat out he thought 
they would have identical fingerprints. 
I was standing there kinda sweating 
and said, 'Well, I don't think so, but 
we'll take a look.' I finished the talk 
and got to the demonstration time and 
they immediately leaped to their feet. 
We checked the rigs and they were 



like chalk and cheese, totally different. 

"A small percentage of rigs have 
two or more fingerprints. Theoretically, 
there are two predictable routes for 
PLL lockup. It's unlikely a given radio 
would be set up so it could take both 
routes, but it can happen." A rig's fin- 
gerprint may change slightly as you 
tune different parts of the same ham 
band. Dual- and multiband VHF/UHF 
rigs have completely different prints on 
each band. 

K7PF soon realized he had a mar- 
ketable signal identification system. "In 
a rare moment of greed, I ran it past 



the Boeing patent staff," he says with a 
chuckle. "That turned out to be a good 
move." Transmitter fingerprinting is 
now patented and assigned to Boeing, 
who sees to it that nobody makes 
commercial use of this idea without 
compensating Boeing and K7PF for it. 

Next, FCC heard about fingerprint- 
ing and asked for some of Ferrell's 
equipment to evaluate. About this 
time, Don Moser AA7Y of Motron 
Electronics heard about the system at 
the Sea-Pac ham convention. K7PF 
showed AA7Y his breadboard and 
they worked out a deal for Motron to 



manufacture the circuit boards for Fer- 
rell's FCC contract and to market the 
finished product, called the TxlD-1, to 
the public. 

Dozens of 78s 

Phil's description fingerprinting 
made sense to me, but I was a bit 
skeptical at first about just 64 super- 
samples providing positive identifica- 
tion of like-model transmitters. For a 
rigorous test, I decided to take TxlD-1 
to "a meeting of the 78's Amateur Radio 
Club. This group was formed to teach 
the arcane art of programming the 



2-1000 MHz In One Swee 

AVCOM'sNewPSA-65A Portable Spectmm Analyzer 




The newest in the line of rugged 
spectrum analyzers from AVCOM 
offers amazing performance for only 
$2,855. 

AVCOM'S new PSA-65A is the 
first low cost general purpose port- 
able spectrum analyzer that's 
loaded with features. It's small, 
accurate, battery operated, has a 
wide frequency coverage - a must 
for every technician's bench. Great Large bright screen for 
for field use too. ou,cloor and indoor use - 

The PSA-65A covers frequen- 
cies thru 1000 MHz in one sweep 
with a sensitivity greater than -90 
dBm at narrow spans. The PSA- 
65A is ideally suited for 2-way ra- 
dio, cellular, cable, LAN, surveil- 
lance, educational, production and 
R&D work. Options include fre- 
quency extenders to enable the 
PSA-65A to be used at SATCOM 
and higher frequencies, audio 
demod for monitoring, log periodic 
antennas, carrying case (AVSAC), 
and more. 

For more information, write, FAX 
or phone. 

AVCOM 



on the screen. 



VERT is used to 
SWEEP RATE controls the P osition tne dis P la y 
speed of the sweep across 
the CRT. 



Portable, attractively styled 
package and ergonometri- 
cally engineered front panel 
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FREQUENCY 



TUNING adjusts the center frequency of the 

SCALE selects an amplitude ',' d7 Q 7 t 7cD~disDlav ana| y zer so that si 9 nals of interest a PP ear at 5he 
sensitivity of either 10 dB/DIV , P y center of the display and their frequency is read 



out on the LCD. 



POWER switch has 3 
positions: Battery Operation, 
Standby and AC Line Opera- 
tion. Ext. DC Power switch 

on rear panel for 12 volt 
operation. 

BAT CHG switch recharges PSA-65A 
80% capacity in approx. 6 hours. 



AUDIO OUT drives low 
impedence earphone or 
speaker. Internal speaker 
provided with optional demod. 





AUXILIARY supports present 
and future optional 
accessories for the PSA-65A. 



REFERENCE LEVEL adjusts 
input attenuator and IF gain. 
Calibrations in dBm and 
dBmv are provided. 

ZERO SPAN instantly places 
analyzer in zero span mode 
and activates audio 
demodulator for convenient 
monitoring. 

SPAN controls the width of the 
spectrum being displayed and 
automatically selects optimum 
resolution filter, 



RF INPUT accepts signals to be 
observed from less than 2 Mhz to 
greater than 1000 Mhz. 



AUDIO DEMOD 

activates audio demod 
board and sets audio 
level. 



VAR SPAN reduces the width oi 
the spectrum being displayed for 
closer signal examination and 
enhanced amplitude accuracy. 



BRINGING HIGH 
TECHNOLOGY 
DOWN TO EARTH 



500 SOUTHLAKE BOULEVARD 
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Kenwood TH-78A handheld to new 
purchasers. Dozens of TH-78S and 
other HTs would be there. Could TxID- 
1 display the unique features of many 
rigs of the same type? 

Motron's TxlD-1 system consists of 
the data acquisition and control board 
that plugs into the expansion slot of an 
IBM PC or compatible computer, an in- 
terface board, and a PC software pro- 
gram written by George Hadley N7SNI. 
TxlD-1 connects directly to the receiv- 
er's discriminator and includes its own 
fast squelch circuit for uniform timing. 

For this experiment, I mounted the 
main board in WB6UZZ's Compaq 
Portable 286 PC and connected it to a 
Bearcat BC210XL scanner (Photo A). 
The interface board (Photo B) plugs in- 
to the TxlD-1 main board and has con- 
nections for receiver discriminator 
(mandatory) and AGC (optional). The 
BC210 is easy to adapt to TxlD-1. 
There is plenty of room inside, RCA 
jacks mount readily on the steel rear 
panel, and its discriminator tap-off 
point is easy to locate. 

Discriminator polarity and voltage 
swing differ among receiver models. To 
ensure that TxlD-1 accurately displays 
the instantaneous frequency, you must 
calibrate the discriminator frequency- 
versus-voltage curve in 1 kHz steps. I 
used a TS-700A VFO-controlled rig 
and a VHF frequency counter to get 
the data for the BC210XL passband in 
about 10 



minutes. 

With this data, running OPAMP.EXE 
(supplied on the program disk) calcu- 
lates values of two resistors to set gain 
and polarity of the input operational 
amplifier on the TxlD-1 board to match 
your receiver. I ran the program, found 
the resistors in my junkbox, and sol- 
dered them to the supplied component 
header in less than 15 minutes. Note 
that the whole procedure must be 
done over if you change receivers. 

I tested version 1.15, the current 
software revision, which is menu-driv- 
en with single-character commands, it 
supports the Microsoft Mouse, but not 
Windows. A 486 with fast hard drive 
and VGA/EGA monitor provides best 
performance, but a compatible with 
512K memory, CGA graphics, and a 
floppy drive will do. 

I tried to enter the frequency to be 
displayed in the fingerprint disk file, but 
the entry was not accepted. AA7Y 
says this is a software bug that will be 
fixed in the next revision. That is why 
all the plots in this review show 
00.0000 on the frequency line. The 
first signal I fingerprinted was a crys- 
tal-controlled repeater output (Figure 
1). Most repeaters have continuously 
running oscillator stages, so there is 
no PLL hunting. 

Immediately following the 200 mil- 
lisecond sample period, the program 
displays the fingerprint on the left side 
of the screen, along with the detected 



CTCSS frequency, if any, and the sig- 
nal amplitude, if receiver AGC input is 
provided. From that point until the 
transmission ends, it decodes and dis- 
plays any DTMF digits received and 
determines the maximum deviation of 
voice and DTMF modulation. The dis- 
play also includes the date and exact 
time of transmission start and stop. 

A new fingerprint is produced each 
time a transmission begins. Of course, 
prints of repeater users must be made 
on the input frequency, as fingerprint 
data does not pass through the re- 
peater. If you accidentally set the re- 
ceiver to the output frequency, you will 
see the print of the repeater transmit- 
ter, not the user. 

With the MOVE command, you can 
put the fingerprint of your choice on 
the right side of the screen for compar- 
ison with incoming prints on the left 
(Figure 2). The COMPARE command 
(not shown in the figure) overlays the 
print from the right side onto the print 
on the left, in different colors if you 
have a color monitor. 

When COMPARE is commanded, 
the program automatically calculates a 
figure of merit for the difference in the 
two overlaid prints. "It subtracts the 
corresponding values of each super- 
sample, with a maximum allowable dif- 
ference value of 2 kHz each," says 
N7SNI. "The 64 difference values are 
each squared, then all are averaged." 

Perfect correlation would give a 



mean-square difference of zero. That 
rarely happens, but most rigs have on- 
ly small differences between transmis- 
sions, whereas prints of non-identical 
rigs usually show much higher differ- 
ence numbers. The difference value is 
4 for the two transmissions of Figure 1 , 
and 9 for those of Figure 2. 

By selecting the appropriate pro- 
gram mode, some or all fingerprints 
can be stored on disk. They can also 
be recorded on audio tape. Using a 
stereo tape deck, you can simultane- 
ously log user fingerprints and audio 
on the left and right channels. The 
manual says the program will turn on 
your recorder at the start of a transmis- 
sion and delay the audio until it comes 
up to speed, but I did not test this fea- 
ture. 

I spent much time using the ANA- 
LYZE feature, which allows compari- 
son of fingerprints stored in one or 
more disk files. You can also put an 
annotation line on the prints and edit 
them down into a master file. The 
MOVE and COMPARE functions work 
perfectly with disk-stored prints, but 
there are minor program bugs in stor- 
ing and display of the DTMF and devi- 
ation data. 

The Acid Test 

So how did TxlD-1 do with different 
rigs of the same model? Very well! 
Most-times, the differences were obvi- 
ous, as shown in Figure 3. The mean- 
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RLC-3 8 PORT CONTROLLER 



FEATURES: 

• All ports can be configured as links or repeaters 

• Low power CMOS operation 

• Separate user programmable courtesy beeps 
for each port 

• Fully DTMF and Serial programmable 

• Unique Voice and CW ID's for each port 

• 4-Layer high quality board construction 

• Ports can be connected in any combination 

• 2/5-6 tone paging 

• Autopatch option available 

• Add radio ports as your systems grows 

• Priced to meet your club's budget 



BENEFITS: 

With DTMF and serial programming features, your controller is more secure from unwanted access. Talk out your Icom, 
Kenwood and Yaesu HF radios with your handheld. Make emergency autopatch calls. Have the nicest sounding audio on 
your repeater system. Link to other repeaters, satellites, or systems using only 1 controller. Run all of your club's repeaters 
with only 1 RLC-3 Controller. Let the scheduler functions automatically wake up in the morning, turn on/off nets, and tell 
you what time it is. Only the RLC-3 can give you all of these benefits in 1 affordable package 

LINK COMMUNICATIONS, INC. 

115 2nd Ave. N.E.,Sidney, MT 59270 

(406) 482-7515 (Voice) (800) 610-4085 (Orders) (406) 482-7547 (Fax) 
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Photo B. The IA-1 Interface Adapter board has jacks for receiver discriminator 
and S-meter input, plus tape recorder on/off and audio. It attaches to the TxlD-1 
Transmitter Identifier board mounted inside the computer. The unused DB25 
connector is for optional RS-232 control of AR-3000 receivers. 



square numeric value in the COM- 
PARE mode for these two prints is 
179. 

TH-78S and other Kenwood rigs 
settle on frequency much faster than 
other brands, so they were harder to 
tell apart. But it was still possible to 
find differences, usually in the final fre- 
quency after PLL settling. (Of course, 
this value might be affected by such 
factors as temperature fluctuations in 
the transmitter and/or receiver, so care 
must be used.) 

For fast-settling rigs, it would be de- 
sirable to eliminate the 2 millisecond 
delay between squelch activation and 
start of the print. Phii says he is work- 
ing on a firmware upgrade that will 
store data to allow "looking back" be- 
fore the squelch opens, to the exact 
start of transmissions. 

A few HTs had wild variations in 
consecutive-transmission fingerprints, 
which turned out to be caused by 
near-dead batteries. Features such as 
a rig's battery saver also cause 
changes in its fingerprint (Figure 4). 
Then there was one rig at the meeting 
that seemed to have an unlimited 
number of prints that were similar, but 
with definite differences. I compared 
10 prints from this rig and found only 7 
out of the 45 possible comparisons 
had mean-square difference numbers 
less than 100. To avoid giving aid and 
comfort to potential troublemakers, I 
will not reveal the make and model. 
Fortunately, other rigs of this type at 
the meeting did not have these varia- 
tions. 

Parting Shots 

Learning to use the TxlD-1 is fairly 
easy and intuitive, but I can only give 
the manual a grade of C. It has plenty 
of detail to help you connect to re- 
ceivers and recording gear. There are 
advanced topics such as command- 
line parameters and script files. But in- 
formation on how to analyze and com- 
pare your prints is hard to find. For in- 
stance, there is no help in interpreting 
the mean-square difference function in 



the COMPARE mode and no explana- 
tion why the CTCSS frequency read- 
out often gives false indications. 

Motron's telephone support was 
very good, and I was able to get some 
added information on the program by 
reading the large (50K) help file on the 
program disk. Don Moser of Motron 
says a new manual is coming, along 
with Revision 2 of the software. It will 
fix all the known bugs. Also in the 
works is a remote access feature. You 
will be able to put TxlD-1 on the re- 
ceiver at your mountaintop repeater 
and downlink fingerprints via phone or 
packet radio. 

I would like to see some other im- 
provements in the software, such as a 
hard copy printout function. For the fig- 
ures in this article, I used the comput- 
er's "PRINT SCREEN" key with a dot 
matrix printer after running the 
"GRAPHICS" command from DOS. 
There should also be an faster and 
easier way to start and stop the finger- 
printing function without exiting to the 
MONITOR menu. 

It would also be great if TxlD-1 
could be programmed to automatically 
search your database of known user 
transmitters and select the closest 
print or prints in it when your repeater 
is keyed up. This would be a faster 
way to identify "kerchunkers." Also, 
how about a way to automatically alert 
the operator when a particular rig 
comes on the air? This would be es- 
pecially valuable when someone's 
transceiver is stolen. Don, Phil, and 
George say they are working on such 
features. 

At $699 plus $8 shipping for the 
complete TxlD-1 hardware and soft- 
ware package plus the cost of the 
computer and receiver, the Motron fin- 
gerprint system won't find its way into 
the average ham shack. However, it is 
well within the budget of many re- 
peater clubs and is certainly a worth- 
while addition to the arsenal of re- 
peater councils and interference com- 
mittees. 

From its introduction, TxlD-1 has 



had steady sales to government, 
amateur, and commercial purchasers. 
But according to AA7Y, many cus- 
tomers don't want the fact that they 
own TxlD-1 to be public knowledge. 
"Nonsense!" says K7PF. "A system like 
fingerprinting does no good unless 
people know about it. A ham from Vic- 
toria, British Columbia tells me that the 



TxlD-1 is like having a shotgun by the 
door. It never needs to be used, but 
everybody knows its there just in 
case." 

TxlD-1 is not sold at ham stores. It 
is available only from Motron Electron- 
ics, 310 Garfield Street, Suite 4, PO 
Box 2748, Eugene OR 97402, (503) 
687-2118. m 
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